POST_START

Auditing Emergency Production Access After an Incident

Yesterday, we experienced a minor security incident involving access to the production catalog. A user with temporary emergency access was found to have interacted with critical data in the production environment. Now, I’m tasked with auditing who has access to the production catalog and how it’s being used. I’ll start by checking the grants on the production catalog itself.

SHOW GRANTS ON CATALOG production;

I ran the SHOW GRANTS ON CATALOG production; command to see what permissions are granted at the catalog level. This will help me understand who has the ability to access or modify data across the entire production catalog.

principal | actionType | objectType
data_analysts | SELECT | TABLE
data_engineers | MODIFY | TABLE

I saw a representative result like this. It shows that the data_analysts group has SELECT access to tables, and the data_engineers group has MODIFY access. This means these groups can read and potentially write to the tables in the production catalog.

Next, I wanted to check if there were any specific grants on the sales schema within the production catalog. This will help me narrow down the access to a specific business unit and understand if there are any additional permissions beyond the catalog level.

SHOW GRANTS ON SCHEMA production.sales;

I ran the SHOW GRANTS ON SCHEMA production.sales; command to see what permissions are granted on the sales schema. This will help me identify if there are any schema-level grants that might override or supplement the catalog-level grants.

principal | actionType | objectType
data_analysts | SELECT | TABLE
data_engineers | MODIFY | TABLE

I saw a representative result like this. The grants on the sales schema are the same as those at the catalog level. This means the access is consistent across the catalog and the schema, which is expected. However, it also means the same groups have access to the sales data.

Now, I need to look into the audit logs to see who has actually accessed the production data recently. This will help me determine if there were any unauthorized or unexpected interactions with the production catalog.

SELECT * FROM system.access.audit WHERE request_params LIKE '%production%' ORDER BY event_time DESC;

I executed the SELECT * FROM system.access.audit WHERE request_params LIKE '%production%' ORDER BY event_time DESC; query to find all audit records that mention the word “production” in the request parameters. This will give me a list of recent access events to the production catalog, helping me trace who accessed what and when.

event_time | user_identity | action_name | request_params
2026-09-11 14:32:10 | analyst@demo.com | commandSubmit | {table: production.sales.customers}
2026-09-11 14:31:55 | engineer@demo.com | getTable | {table: production.sales.customers}

I saw a representative result like this. The output shows that two users accessed the production.sales.customers table recently. The first was an analyst who submitted a command, and the second was an engineer who retrieved table metadata. This confirms that the access is being used, and it’s important to verify that these users are authorized to access the data.

By reviewing the grants and the audit logs, I’ve confirmed that the data_analysts and data_engineers groups have access to the production catalog and the sales schema. The audit logs show recent interactions, which may be normal operations but should be reviewed for any signs of misuse or unauthorized access.

With this information, I can now create a report on the current access patterns and recommend additional controls or monitoring to ensure that emergency access is properly managed and audited in the future.